22 CVEs affecting Cyrus products, 0 known to be exploited (CISA KEV), with EPSS scores. Most affected: Imap, Sasl, Imapd, Libsieve.